The present invention relates to an infusion device comprising a pump system having a plurality of infusion pumps and a central controller communicating via data channels with the individual infusion pumps.
The more and more complex medication of intensive-care patients requires central preparation of the medication data. The technical solutions previously referred to as documentation systems do not allow, for safety-relevant considerations, remote control of the infusion pumps. An essential reason for this restriction is that programmable systems of single-channel structure do not prevent the occurrence of a first error. For this reason dual-channel structures were created. This solved the problem of undetected arithmetical errors and undetected changes in the memory but did not help to attain the necessary overall safety required for connecting two systems operating perfectly from the safety point of view. This becomes evident when an infusion system, which may comprise nine pumps or other medical apparatus, is to be combined to form an overall system with the safety aspects being taken into consideration. The prerequirements for such a solution are:
unambiguous identification of each individual infusion apparatus,
prevention of falsification of data owing to physical one-channel transmission,
prevention of incorrect allocation (addressing) of infusion apparatus,
detection of removal of an infusion apparatus from the infusion system,
parallel automatic/manual operation,
action-dependent infusion, i.e. bolus administration for the duration of a key depression.
It is an object of the present invention to provide an infusion device comprising a central controller and a plurality of infusion apparatus, which meets the safety requirements to a large extent.
According to the invention each infusion apparatus is provided with a unique identification number. After connection of a pump the infusion device carries out an identification process with the unique identification number of the infusion apparatus being the central element of this identification process. The controller is requested to ask, prior to the remote control, for the identification number of the newly detected infusion apparatus. Then the infusion apparatus transmits the identification number to the controller which checks whether this identification number has already been allocated. If this is the case, the identification number is sent back to the infusion apparatus either in unchanged or in modified form. Only when the signal returned has been detected as correct the infusion apparatus will accept remote control commands from the controller. By checking the identification number the controller ensures that the identification number has been allocated only once in the infusion system concerned. This prevents the use of identification numbers which have by mistake been allocated more than once. On the other hand, the infusion apparatus recognizes on the basis of the returned signal that the controller has completed a check of the identification number with positive result and accepts only then the remote control commands from the controller. The present invention ensures that a data-addressable infusion apparatus exists only once in the system and can be clearly identified. It is prevented that two infusion apparatus bear the same identification number, which would result in parallel addressing of the two infusion apparatus by the control computer and thus in unintended overdosing.
Preferably the signal sent back by the controller and corresponding to the identification number is the inverted identification number. This means that the 0-bits are converted into 1-bits and the 1-bits into 0-bits. These simple logic means allow a comparison between the identification number and the modified identification number. Of course, more complex modifications of the identification number are possible.
The problem regarding falsification of data due to the physical one-channel transmission is solved according to a preferred aspect of the invention in that the controller and the control unit of the infusion apparatus are of dual-channel configuration and that one channel provides the data to be transmitted, while the other channel generates a password corresponding to said data. This means that the data safeguarding processes, where a password depending on the contents of the code word is generated for each code word, are transferred to the dual-channel technique with one channel transmitting the codeword (data) and the other channel generating the password. Code word and password are transmitted via the unique data channel. The dual-channel structure of controller and infusion apparatus is used for data safeguarding purposes. While the first channel makes available the data to be transmitted, the second channel generates independently of the first one the respective password. The password is for example a CRC polynominal. It is ensured that a password is not by accident added or generated by a data-providing channel.
The data generated by the controller must reach the respective infusion apparatus without mistaken identification. This is realized by using the identification number. The data safeguarded by a password are further labelled by adding an identification number. The infusion apparatus checks the labelled data for correspondence with its own identification number. Only in the case of correspondence the data wil be accepted.
Removal of the infusion apparatus from the system or unintended interruption of the connection between infusion apparatus and controller may result in overdosing when for example the rate to be supplied by the respective infusion apparatus is continuously changed by a control algorithm in the controller. The infusion apparatus expects a valid sequence of communication with the controller within a given fault tolerance time. When no communication sequence occurs, the medication is stopped and switched to a regime which cannot harm the patient.
The controller is preferably configured such that it is adapted to perform two modes of operation with interventions in the operation of the infusion apparatus being accepted and adjustments to the controller being ignored in a xe2x80x9cremote controlxe2x80x9d mode of operation, and interventions in the operation of the infusion apparatus being ignored and adjustments to the controller being accepted in a xe2x80x9cremote regulationxe2x80x9d mode of operation. This solves the problem of parallel operation which occurs since controller and infusion apparatus can be separately operated. Thus it is possible that the controller sets the infusion rate to the value XXX due to a time-variant rate control, while the user adjusts the value YYY on the infusion apparatus. To solve this problem the invention provides both m odes of operation.
According to a further aspect of the present invention the infusion device allows action-dependent infusion. This may be a situation in which a defined flow rate is supplied to the infusion apparatus as long as a key is pressed or the user panel of the controller is actuated, or the infusion apparat us has to feed a rate XXX for the duration of a key depression. According to the present invention the key depression is transferred in small time segments. The controller requires at regular intervals repetition or maintaining of the key depression. If the key depression is not repeated or maintained, this state is interpreted as the key no longer being pressed and the infusion is stopped.